WoyCnwaIhmpk
OgsweglTguefMoyqm
FyeilcVfiuevsZkidrv
Static task
static1
1 signatures
General
-
Target
a1c80cf01e6048ddfb372bbea12fffd2
-
Size
19KB
-
MD5
a1c80cf01e6048ddfb372bbea12fffd2
-
SHA1
beb0116b9e592d61277cc59b082ad21feea72802
-
SHA256
7885441bfc3f9556a2707be8da564f2869289ae0385b53eb53bccaea1a53c102
-
SHA512
2b77f85d5ac0b1e796d62d6312bd927dd0eeedd75c5b81364d0530af2ac6c3c006e9b048209c66f81756a8a1f0d12285e4fb7f87815ca0b61bae311a087e2b73
-
SSDEEP
384:QbQFC2jEb0/tM6HgQrQn+nLGwD1JOaMuPrg8gXNqSzkP76PjfeQ:nFCeE4/tyEQn+5D38W3gXI+reQ
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a1c80cf01e6048ddfb372bbea12fffd2
Files
-
a1c80cf01e6048ddfb372bbea12fffd2.sys windows:4 windows x86 arch:x86
7d77f6a674b5ca5ee386225b403243b1
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntoskrnl.exe
ExInitializeRundownProtection
RtlImageNtHeader
RtlFindLongestRunClear
PsRestoreImpersonation
strcmp
CcSetAdditionalCacheAttributes
FsRtlInitializeMcb
IoCreateSymbolicLink
RtlAppendUnicodeStringToString
IoReportResourceForDetection
CcGetDirtyPages
FsRtlNotifyFilterChangeDirectory
CcScheduleReadAhead
KeInsertQueueDpc
MmIsAddressValid
FsRtlIsNtstatusExpected
NtDuplicateObject
RtlInt64ToUnicodeString
NtAllocateUuids
ExFreePoolWithTag
READ_REGISTER_BUFFER_ULONG
ZwCreateFile
RtlReserveChunk
FsRtlLookupLastLargeMcbEntry
ZwDisplayString
ZwQueryInformationProcess
KeStackAttachProcess
DbgPrint
IoWritePartitionTableEx
KdDebuggerEnabled
ExAllocatePool
strchr
Exports
Exports
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.INIT Size: 1024B - Virtual size: 904B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 82B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ